GnuPG now uses ECC 25519 as default on new key generation - any compatibility issues to worry about?

Question

TL;DR: I'm assuming that if GnuPG made it a default then it should be what we use, but it used "bad" defaults in the past so I'm wondering if there are any tradeoffs to this? More specifically: is ECC 25519 sufficiently adopted by now so that it wouldn't give any compatibility issues as cited by some people in the last couple of years? And can we safely use ECC 25519 then?

Early on, GnuPG defaults weren't quite good, driving the creation of some hardening guides such as Riseup's OpenPGP best practices guide. Currently, however, that guide says we should stick to GnuPG's defaults:

This guide is deprecated, you only need to use the defaults because GnuPG is doing sane things. Just keep your software up-to-date. That is it, you are done! If you had previously tweaked your configurations, you should consider starting over with a base configuration, so you do not have outdated recommendations that are less secure than the defaults.

Over 3 years ago, this question was asked on which one to use on key generation - RSA or ECC, since there was the Curve 25519 option newly available (only NIST and Brainpools were available before that). The answer says either way is fine but that ECC still wasn't widely supported.

And 2 years ago, this question was asked to compare RSA 4096 vs ECC 25519. Both were said to be vulnerable to quantum computing in the answers, although some don't think that is a risk worthy of worrying about now. This post on CryptoStackExchange runs some comparisons.

As far as ECC security goes, the website SafeCurves by B. J. Bernstein compares the different curves. 25519 is apparently much more secure than the other 2 options GnuPG currently gives us (NIST P-384 and Brainpool P-256), so I'd assume 25519 to be secure.

But how does that compare with RSA? Before this new default, GnuPG used to recommend GnuPG 3072, and some people used to opt for 4096.

This more recent post from 2020 says either RSA or ECC should be fine, and that "it is a matter of opinion." I'm no expert but is it? There should be a better choice.

GnuPG's FAQ reads:

The future is elliptical-curve cryptography, which will bring a level of safety comparable to RSA-16384. Every minute we spend arguing about whether we should change the defaults to RSA-3072 or more is one minute the shift to ECC is delayed. Frankly, we think ECC is a really good idea and we’d like to see it deployed as soon as humanly possible.

Which they have now delivered.

My understanding after researching this, and considering that I am not a security or crypto expert, is that ECC 25519 and RSA 4096 would give comparable security, the only difference being the size -- ECC 25519 seems to be more space-efficient and smaller, and thus quicker. But there's the compatibility debate.

I'm assuming that if GnuPG made it a default then it should be what we use, but it used "bad" defaults in the past so I'm wondering if there are any tradeoffs to this? More specifically:

• Is ECC 25519 sufficiently adopted by now so that it wouldn't give any compatibility issues as cited by some in the last couple of years? And can we safely use ECC 25519 then?

Answer 1

Ed25519 and ECDH with Curve25519 have been supported in GnuPG since 2.1. Most OSes, with the exception of CentOS 7, have version 2.2 or newer, so it's possible to use Ed25519 and Curve25519 for almost all operating systems. Additionally, most other OpenPGP implementations support them as well.

These curves have a security strength of approximately 128 bits, which is equivalent to a 3072-bit RSA key. The benefit is that the keys and signatures are much smaller and it is much easier to make implementations of Ed25519 and Curve25519 constant time. These algorithms are considered robust and secure and they are probably the most preferred algorithms right now. In fact, NIST has added support for them to the next draft FIPS standard.

In addition, RSA in OpenPGP uses PKCS #1 v1.5 padding. This padding, unlike the newer RSA-PSS (for signatures) and RSA-OAEP (for encryption) is very easy to accidentally make into a decryption oracle using an attack called the Bleichenbacher attack. Even implementations like OpenSSL have suffered from this problem. The OpenPGP working group does not seem interested in fixing this, and as such, RSA in OpenPGP is probably not the best choice if you can avoid it.

I would strongly encourage the use of Ed25519 and ECDH with Curve25519 (or their equivalents with Curve448) for new keys. Only if you are certain that your tooling doesn't support them should you use an RSA key.